No, since we cleared that up I'm going to discuss this with Alex. It's his problem mainly, because he too has to comply. I've downloaded his tar file and the info is missing on his buildconfig page too. I'm sure it's a bug.

In any case, you don't need to take down the package. You'll just need to supply the source you used for the build in our repo. Just upload the tarball and you're done.

Aren't .so files binaries? Why would they need to be in a source package?

No idea if that helps - a debian guy tells me: "I actually looked at packaging Waterfox -- the upstream tarball has precompiled stuff; there's a github repo but upstream doesn't seem to share whatever his build system is."

If it doesn't work out easily I think we can wait for Alex to react on my bug report. He doesn't seem to be overly concerned with the legal stuff - no wonder, since he's working alone on the project and probably really busy to debug the new version 68. Nobody is going to behead us in the meantime.